Harvest now, decrypt later is a threat model: an adversary records encrypted traffic today and keeps it in the hope of decrypting it later. It matters most when the content must remain confidential for years. It does not mean every chat is already being recorded, or that a date for a useful cryptographic quantum computer is known.
What an attacker would have to collect
The attacker needs a usable copy of ciphertext and enough protocol material to benefit from a future break in the key-establishment method. An end-to-end encrypted message stored as ciphertext on a service is another possible archive. A future attack on classical public-key exchange could expose the session material that protected some archived traffic, depending on the protocol and what was recorded. The exact risk is protocol-specific; an algorithm name alone cannot establish it.
Why hybrid key establishment is relevant
NIST FIPS 203 standardizes ML-KEM, including ML-KEM-768. A hybrid messaging design combines a post-quantum contribution with a classical contribution rather than relying only on a new primitive. Livara's published LVR1 description combines ML-KEM-768 and P-256 in direct-message key establishment. The ML-KEM-768 guide explains the primitive; the ratchet explainer discusses the message protocol.
Where the protection stops
Post-quantum key establishment targets a future passive-decryption threat. It does not hide who communicated, prevent an unlocked device from revealing plaintext, or make a recipient unable to copy a message. Livara's public broadcast channels remain server-readable. Backups and optional recording require their own boundary checks. A standard's publication is not an independent audit of any particular app.
A practical review checklist
- Identify the conversation type and the exact client version.
- Ask which key establishment protected the archived content, and whether downgrade paths exist.
- Read the key-change, device-enrollment and recovery rules.
- Separate message content from metadata, backup and endpoint risks.
- Check the stated audit scope before treating a design claim as independently verified.
Long-lived confidentiality is a reason to examine a protocol now. It is not a promise that today's implementation is invulnerable to future attacks.
